How ordinary operators investigate incidents without specialist training — the Audit Workbench story
Frontline teams need narratives, not query languages. The workbench pattern: guided investigation with receipts — not a blank search box.
The gap
Most “audit tools” assume an analyst who speaks SQL and vendor APIs. Operators need stories they can act on during an incident.
The workbench idea
Start from symptom → candidate runs → timeline → human decisions → exportable narrative.
Why training stays light
Guided flows encode what good looks like — the system teaches while it protects scope.